Metalama 受 CVE-2026-62847 影響：Linux/macOS 上 DLL 植入可導致本地許可權提升

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.

Impact

Affected Products

The following products are affected by CVE-2026-62847 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Update Metalama to version 2026.1.19 or later to relocate cache directories.

• Update Metalama.Framework and Metalama.Tool to version 2026.1.19+.
• Verify cache directories are in per-user locations.
• Remove old cache directories from temporary locations.

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-62847.

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-62847 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-62847 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-62847 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-62847 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

• New CVE Received by [email protected]

  十月. 30, 2026

  Action	Type	Old Value	New Value
  Added	Description		Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.
  Added	CVSS V3.1		AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
  Added	CWE		CWE-427
  Added	CWE		CWE-377
  Added	Affected		New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/62xxx/CVE-2026-62847.json">CVE-2026-62847</a>
  Added	Reference		https://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9
  Added	Reference		https://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e
  Added	Reference		https://github.com/metalama/Metalama/pull/1650
  Added	Reference		https://github.com/metalama/Metalama/releases/tag/release/2025.1.18
  Added	Reference		https://github.com/metalama/Metalama/releases/tag/release/2026.0.25
  Added	Reference		https://github.com/metalama/Metalama/releases/tag/release/2026.1.19
  Added	Reference		https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.